CVE-2021-25929

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-25929
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25929.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-25929
Aliases
Published
2021-05-20T15:15:07.603Z
Modified
2026-02-11T07:38:13.840958Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the name parameter in noticeWizard endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.

References

Affected packages

Git / github.com/opennms/opennms

Affected ranges

Type
GIT
Repo
https://github.com/opennms/opennms
Events
Introduced
67c7635a68963a3005df7aedd41195eb23d9f41b
Fixed
399ed865e66ec3cb60674c3e7ec8403309754dfb
Introduced
0d3624eadab83197935d675b014fa7d8190e0258
Fixed
4ad904678528a4f8e26ae3e776b1009f6564be2e
Fixed
66c1f626bf38a7d1a9530b4d68598269ee5245a2
Introduced
9e5617454f5f5d44dcd2fff3a33b603038b52530
Fixed
bfd3de5ac0f158e2e1a257d0ee30291281334e60
Fixed
eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c

Affected versions

meridian-foundation-2015.*
meridian-foundation-2015.1.0-1
meridian-foundation-2015.1.1-1
meridian-foundation-2015.1.10-1
meridian-foundation-2015.1.2-1
meridian-foundation-2015.1.3-1
meridian-foundation-2015.1.4-1
meridian-foundation-2015.1.5-1
meridian-foundation-2015.1.6-1
meridian-foundation-2015.1.7-1
meridian-foundation-2016.*
meridian-foundation-2016.1.1-1
meridian-foundation-2016.1.10-1
meridian-foundation-2016.1.15-1
meridian-foundation-2016.1.2-1
meridian-foundation-2016.1.3-1
meridian-foundation-2016.1.4-1
meridian-foundation-2016.1.5-1
meridian-foundation-2016.1.6-1
meridian-foundation-2016.1.7-1
meridian-foundation-2016.1.9-1
meridian-foundation-2017.*
meridian-foundation-2017.1.0-1
meridian-foundation-2017.1.10-1
meridian-foundation-2017.1.2-1
meridian-foundation-2017.1.3-1
meridian-foundation-2017.1.4-1
meridian-foundation-2017.1.5-1
opennms-15.*
opennms-15.0.0-1
opennms-15.0.1-1
opennms-15.0.2-1
opennms-16.*
opennms-16.0.0-1
opennms-16.0.1-1
opennms-16.0.2-1
opennms-16.0.3-1
opennms-16.0.4-1
opennms-17.*
opennms-17.0.0-1
opennms-17.1.0-1
opennms-17.1.1-1
opennms-17.1.1-2
opennms-17.1.1-3
opennms-18.*
opennms-18.0.0-1
opennms-18.0.1-1
opennms-18.0.2-1
opennms-18.0.3-1
opennms-18.0.4-1
opennms-19.*
opennms-19.0.0-1
opennms-19.0.1-1
opennms-19.1.0-1
opennms-20.*
opennms-20.0.0-1
opennms-20.0.1-1
opennms-20.0.2-1
opennms-20.1.0-1
opennms-21.*
opennms-21.0.0-1
opennms-21.0.1-1
opennms-21.0.2-1
opennms-21.0.3-1
opennms-21.0.4-1
opennms-21.0.5-1
opennms-21.1.0-1
opennms-22.*
opennms-22.0.0-1
opennms-22.0.1-1
opennms-22.0.2-1
opennms-22.0.3-1
opennms-22.0.4-1
opennms-23.*
opennms-23.0.0-1
opennms-23.0.1-1
opennms-23.0.2-1
opennms-23.0.3-1
opennms-23.0.4-1
opennms-24.*
opennms-24.0.0-1
opennms-24.1.0-1
opennms-24.1.1-1
opennms-24.1.2-1
opennms-24.1.3-1
opennms-25.*
opennms-25.0.0-1
opennms-25.1.0-1
opennms-25.1.1-1
opennms-25.1.2-1
opennms-25.2.0-1
opennms-25.2.1-1
opennms-26.*
opennms-26.0.0-1
opennms-26.0.1-1
opennms-26.1.0-1
opennms-26.1.1-1
opennms-26.1.2-1
opennms-26.1.3-1
opennms-26.2.0-1
opennms-26.2.1-1
opennms-26.2.2-1
opennms-27.*
opennms-27.0.0-1
opennms-27.0.1-1
opennms-27.0.2-1
opennms-27.0.3-1
opennms-27.0.4-1
opennms-27.0.5-1
opennms-27.1.0-1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25929.json"
vanir_signatures 
[
    {
        "id": "CVE-2021-25929-025f01ec",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "274512322503962685663647942214031473657",
                "239957005078604087605198069636665484125",
                "51297086796185311165292000712741592405",
                "89316630911645056401425776591707967796"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/399ed865e66ec3cb60674c3e7ec8403309754dfb",
        "target": {
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-04412c6e",
        "signature_type": "Function",
        "digest": {
            "function_hash": "144759024573714915384785318319942410353",
            "length": 314.0
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
        "target": {
            "function": "renameGroup",
            "file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-26db798a",
        "signature_type": "Function",
        "digest": {
            "function_hash": "140896969588649620875571293911303623336",
            "length": 378.0
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
        "target": {
            "function": "doPost",
            "file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-4ca5ed5d",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "90253076573762629441991201053642862341",
                "185873649126861724685726372711740872634",
                "149815560412617795143529862159006894425",
                "128832419303514585476897369727768091496",
                "300085948881960968911544874291612168973",
                "12820140683984487976562972080714370305",
                "246987876076312931306991004069060899035",
                "127787666618096054252344114437365060347",
                "83974609003967063528889762669717878676",
                "320243472818479108232448567180361972797"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/66c1f626bf38a7d1a9530b4d68598269ee5245a2",
        "target": {
            "file": "smoke-test/src/test/java/org/opennms/smoketest/NotificationsPageIT.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-756876d8",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "63862115445021482406981461159020448473",
                "192790766046859987790732110517539223001",
                "264559957673844931483714759827957494060",
                "187562419973017837990659765287661653505"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
        "target": {
            "file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-84167b85",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "89256397304596016052036103843694799455",
                "228142828937052465100599374335507169788",
                "253436531422684568205797174898232887867"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
        "target": {
            "file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/RenameUserServlet.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-8629809b",
        "signature_type": "Function",
        "digest": {
            "function_hash": "131658155818715672810866632343923060109",
            "length": 185.0
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/399ed865e66ec3cb60674c3e7ec8403309754dfb",
        "target": {
            "function": "getFrameworkUrl",
            "file": "opennms-full-assembly/src/test/java/org/opennms/assemblies/karaf/OnmsKarafTestCase.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-b51ae946",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "58730506138354010431660930680209411599",
                "131372045428180590852460578241088976601",
                "107737349864204963929678012583384325367",
                "6897653343869269317735066625920671701",
                "220882383980174487142093456676728608479",
                "52485355072899409265839311709820086238"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
        "target": {
            "file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-cb44f906",
        "signature_type": "Function",
        "digest": {
            "function_hash": "296653347434168606010481034581794117613",
            "length": 610.0
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
        "target": {
            "function": "addGroup",
            "file": "opennms-webapp/src/main/java/org/opennms/web/controller/admin/group/GroupController.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-d4ce405d",
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "215985755002245887884707550113681684850",
                "11438173654715828717935667960271049116",
                "176681594848500904939248140376016076557"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
        "target": {
            "file": "smoke-test/src/test/java/org/opennms/smoketest/UserIT.java"
        },
        "deprecated": false
    },
    {
        "id": "CVE-2021-25929-eed35066",
        "signature_type": "Function",
        "digest": {
            "function_hash": "198479055700301882740520908056306576753",
            "length": 1151.0
        },
        "signature_version": "v1",
        "source": "https://github.com/opennms/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98c",
        "target": {
            "function": "doPost",
            "file": "opennms-webapp/src/main/java/org/opennms/web/admin/users/AddNewUserServlet.java"
        },
        "deprecated": false
    }
]